Signature apparatus, verifying apparatus, proving apparatus, encrypting apparatus, and decrypting apparatus

Abstract

Provided are a signature apparatus, a verifying apparatus, a proving apparatus, an encrypting apparatus, and a decrypting apparatus capable of efficiently reducing a signature text counterfeit problem to a discrete logarithm problem. The commitment is a hash value of a set of a value to be committed. Data including a pair of elements of a cyclic group associated with a discrete logarithm problem is used as a public key, and a discrete logarithm of an order of the pair is used as a secret key. Accordingly, it is possible to summarize secret information of an attacker from the commitment without rewinding the attacker and to ensure a higher safety than that of a Schnorr signature scheme. In addition, one-time power residue calculation is performed in each of the signature and verification calculations, so that it is possible to lower an amount of calculation in the signature and verification calculations.

Description

[0001]This application is the National Phase of PCT / JP2005 / 022875, filed Dec. 13, 2005, which claims priority to Japanese Application No. 2005-014891, filed Jan. 12, 2005, the disclosures of which are hereby incorporated by reference in their entirety.[0002]1. Technical Field[0003]The present invention relates to a signature apparatus, a verifying apparatus, a proving apparatus, an encrypting apparatus, and a decrypting apparatus and, more particularly, to a signature apparatus, a verifying apparatus, a proving apparatus, an encrypting apparatus, and a decrypting apparatus capable of efficiently reducing a signature text counterfeit problem to a discrete logarithm problem.[0004]2. Background Art[0005]A public key is a cipher which uses different keys for encrypting and decrypting. The key used for the decrypting is maintained in a secret state, while the key used for the encrypting is publicized. The public key needs a system for ensuring an authenticity of a key to be publicized. H...

AI Technical Summary

Benefits of technology

[0067]According to the present invention, the hash value is used as a commitment, so that it is possible to summarize secret information of an attacker from the commitment without rewinding the attacker and to ensure a higher safety than that of a Schnorr signature scheme. In addition, one-time power residue calculation is performed in each of the signature and verification calculations, thus it is possible to lower an amount of calculation in the signature and verification calculations.DESCRIPTION OF EXEMPLARY EMBODIMENTS

[0068]Hereinafter, configurations and operations of a signature apparatus and a verifying apparatus according to exemplary embodiments will be described.First Exemplary Embodiment

[0069]FIG. 1 is a block diagram illustrating configurations of a signature apparatus SBN0 and a verifying apparatus VBN0 according to a first exemplary embodiment. The signature apparatus SBN0 receives data by using a receiving apparatus RBN0 and transmits data through a transmitting apparatus SeBN0. The verifying apparatus VBN0 receives data by using a receiving apparatus RBN1. For example, LAN or Internet can be used as a channel used for data communication, but the present invention is not limited thereto.

[0071]Symbol A denotes a cyclic group of which order is q. The number of bits of the order q is κ. Symbol g denotes a base point of the cyclic group A. It is assumed that, although the order q of the cyclic group A is publicized, the discrete logarithm problem associated with the cyclic group A is hard to falsify.

[0072]Symbol Z denotes a ring of all integers. Symbol N denotes a set of all natural numbers. An i-th component of a vector “a” is denoted by a_i. An inner product is denoted by <•, •>. An inner product of a vector “a” and a vector “b” is represented by <a, b>=a—1b—1+ . . . a_Nb_N. An X-value hash function of a set X is denoted by H_X.

[0073]Now, a key generating method is described. An xε(Z / qZ)\{0} is taken at random, and h=g^x is obtained. A public key and a secret key are (g, h, q) and x, respectively. The signature apparatus SBN0 reserves the public key and the secret key in a storage unit SB0. It is assumed that the public key is reserved in a location, from which the verifying apparatus VBN0 can acquire the public key in any type of an acquisition method. The acquisition method is, for example, means for reserving the public key in a public key table publicized on the Internet or means for directly acquiring the public key from the signature apparatus SBN0. The verifying apparatus VBN0 acquires the public key and reserves the public key in the storage unit SB0 if needed. Details of the key generating method are disclosed in Non-Patent Document 11. Hereinafter, the description is made under the state that the verifying apparatus VBN0 has already acquired the public key.

Problems solved by technology

Among the current used crypto schemes, an efficient decryption method has not yet been implemented, and safety of most crypto schemes has not been proven.

Images